Each of your customers should be placed in a separate sub-account. If a customer has multiple domains, you would keep their domains all in the same sub-account so that when they login to the white label control panel, they can manage all their domains with a single login (and only see their own domains).
A sub-account refers to a group of your client's domains. You can see & manage which of your client's domains are grouped together in a sub-account by visiting Reseller > Customer Accounts.
When you group multiple domains into the same sub-account, and create account contacts for your customer to use in the white label control panel, then when your customer logs in, they will see and have access to only the domains that you included in the same sub-account.
When a setting in the control panel (for example, the geographic policies or custom filters) specifically indicates that the setting will affect a sub-account, then that setting will affect whatever domains are in the same sub-account as the domain you currently have selected.
So, for example, suppose you have clients a.com , b.com , and c.com . a.com and b.com belong to the same client, so you group them into the same sub-account, so that when your client logs in to their white label control panel, they can see both a.com and b.com , but not c.com (which belongs to a different client).
When your client changes an account level setting in the white label control panel, it's actually just a "sub-account" wide rule from the reseller's perspective. So it will affect a.com and b.com , but not c.com .
From the reseller's perspective, these same settings will be labeled as "sub-account" settings in the SpamHero control panel. In the SpamHero control panel, the tab labeled account level affects your whole account, so a.com , b.com , and c.com would be affected.